>> Welcome to the beginning
>> of Module 4 of our Nmap Course.
>> In this lesson, I'll be going through
target specifications in Nmap.
Essentially, we'll be talking
about many different ways to
tell Nmap what host and ordinate works to scan.
In the next lesson, we'll walk through a lab.
Thanks for walking through this with me.
In this lesson, we're going to focus
on Nmap's target specification.
First, we'll do a review of
targets that I've already shown you.
Next, I'll provide you with some additional options,
and finally we'll go through a lab.
Let's get started. What is a target in Nmap?
Well, a target is basically the host or
hosts that you are running the Nmap scan against.
This can be in the form of an IPV4
>> address, IPV6 address,
>> fully qualified domain name,
or entire networks using ranges,
lists, or CIDR notation.
Where should you put the target in the Nmap command?
Well, this is entirely up to you,
but as I said before,
I think you should pick a spot and stick to it.
This will help with learning,
and will allow you to get fast and
efficient with your Nmap scans.
I found that putting the target
closer to the end is helpful,
because if you make a mistake in your scan statement,
or simply want to run
the same command again with a different target,
you can hit the up arrow and easily
get back to the target and change it.
Let's go through a quick review of
the common target specifications.
These are all the ones we covered
briefly in a previous lesson.
I put examples out to the right.
The first is Nmap, single IP address.
The second is Nmap,
an IP address range.
The third is Nmap, IP address,
that number of bits that define the network,
otherwise known as CIDR notation.
The fourth is Nmap,
domain name and CIDR notation.
We'll go through these again in the lab.
Now let's talk about some other target specifications
available to you while using Nmap.
Some of these can come in really, really handy.
The first one is Nmap IP address
1 IP address 2, and so forth.
Notice that there is a space between
each IP address, but no comma.
You also should note that the target does
not have to be an IP address.
It can also be a host name,
or a fully qualified domain name.
The point is that you can scan separate targets
using this command simply by
putting a space between the targets.
The second one is Nmap -iL,
followed by the name of the file
that has a list of the targets you wish to scan.
This is really helpful when you have a big list
of IP addresses, host names,
or fully qualified domain names that you want to
scan without having to type each of them in.
This could come in handy when you're
scanning all critical devices
inside and outside
your company's network perimeter, for example.
The third one is actually really interesting.
That is Nmap -iR,
followed by the number of targets.
This scan allows Nmap to randomly determine
IP addresses of hosts to
scan outside the perimeter of your network.
I'm not going to run this one in
the lab because it would go against what
we talked about in our ethics and legalities lesson,
but I'm sure it would do little harm if you create
a polite and very specific scan from your home.
In other words, don't do it at work, or at school.
The fourth one is Nmap,
target or targets, dash,
dash, exclude,
IPs or host names to exclude.
Basically this tells Nmap to scan all of the hosts you
specified except for the ones
in your exclusion statement.
Similarly, the fifth one is Nmap,
targets, dash, dash,
excludefile, the name of the file that
contains excluded IP addresses or host names.
If you want more information about
target specifications, you can use help.
Take a look at the Nmap man page from the command line,
or take a look at the reference URL on this slide.